安云网 - AnYun.ORG | 专注于网络信息收集、网络数据分享、网络安全研究、网络各种猎奇八卦。
当前位置: 安云网 > 技术关注 > 网络安全 > OSSEC日志泛化及告警规则配置

OSSEC日志泛化及告警规则配置

时间:2014-06-17来源: 作者:blackrat点击:
OSSEC是一款开源的多平台的入侵检测系统,可以运行于Windows, Linux, OpenBSD/FreeBSD, 以及 MacOS等操作系统中。包括了日志分析,全面检测,root-kit检测。1. 测试和验证OSSEC泛化及告警规则OSSEC默认具有一个o…

OSSEC是一款开源的多平台的入侵检测系统,可以运行于Windows, Linux, OpenBSD/FreeBSD, 以及 MacOS等操作系统中。包括了日志分析,全面检测,root-kit检测。 //内容来自安云网

1. 测试和验证OSSEC泛化及告警规则

//本文来自安云网

OSSEC默认具有一个ossec-logtest工具用于测试OSSEC的泛化及告警规则。该工具一般默认安装于目录 /var/ossec/bin 中。

//本文来自安云网

//本文来自安云网

使用示例:

//内容来自安云网

/var/ossec/bin/ossec-logtest
2014/06/1113:15:36 ossec-testrule: INFO: Reading local decoder file.
2014/06/11 13:15:36 ossec-testrule: INFO: Started (pid: 26740).
ossec-testrule: Type one log per line.
Jun 10 21:29:33 172.16.25.122/172.16.24.32 sshd[24668]: Accepted publickey for root from 172.16.24.121 port 38720 ssh2

**Phase 1: Completed pre-decoding.
       full event: 'Jun 10 21:29:33 172.16.25.122/172.16.24.32 sshd[24668]: Accepted publickey for root from 172.16.24.121 port 38720 ssh2'
       hostname: '172.16.25.122/172.16.24.32'
       program_name: 'sshd'
       log: 'Accepted publickey for root from 172.16.24.121 port 38720 ssh2'

**Phase 2: Completed decoding.
       decoder: 'sshd'
       dstuser: 'root'
       srcip: '172.16.24.121'

**Phase 3: Completed filtering (rules).
       Rule id: '10100'
       Level: '4'
       Description: 'First time user logged in.'
**Alert to be generated. 
//内容来自安云网

如上文所示,当输入日志内容: //内容来自安云网

Jun 1021:29:33 172.16.25.122/172.16.24.32 sshd[24668]: Accepted publickey for rootfrom 172.16.24.121 port 38720 ssh2

//内容来自AnYun.ORG

该条日志经过三步处理,生成了一条4级告警,规则ID为10100,内容为“First time user
logged in.” //本文来自安云网

//本文来自安云网

使用ossec-logtest–v命令,可获取更详细的日志分析逻辑。

//内容来自AnYun.ORG

/var/ossec/bin/ossec-logtest  -v
2014/06/11 13:44:52 ossec-testrule: INFO: Reading local decoder file.
2014/06/11 13:44:52 ossec-testrule: INFO: Started (pid: 27091).
ossec-testrule: Type one log per line.

Jun 11 21:44:41 172.16.25.122/172.16.24.32 sshd[27743]: Did not receive identification string from 172.16.24.121

**Phase 1: Completed pre-decoding.
       full event: 'Jun 11 21:44:41 172.16.25.122/172.16.24.32 sshd[27743]: Did not receive identification string from 172.16.24.121'
       hostname: '172.16.25.122/172.16.24.32'
       program_name: 'sshd'
       log: 'Did not receive identification string from 172.16.24.121'

**Phase 2: Completed decoding.
       decoder: 'sshd'
       srcip: '172.16.24.121'

**Rule debugging:
    Trying rule: 1 - Generic template for all syslog rules.
       *Rule 1 matched.
       *Trying child rules.
    Trying rule: 5500 - Grouping of the pam_unix rules.
    Trying rule: 5700 - SSHD messages grouped.
       *Rule 5700 matched.
       *Trying child rules.
    Trying rule: 5709 - Useless SSHD message without an user/ip and context.
    Trying rule: 5711 - Useless/Duplicated SSHD message without a user/ip.
    Trying rule: 5721 - System disconnected from sshd.
    Trying rule: 5722 - ssh connection closed.
    Trying rule: 5723 - SSHD key error.
    Trying rule: 5724 - SSHD key error.
    Trying rule: 5725 - Host ungracefully disconnected.
    Trying rule: 5727 - Attempt to start sshd when something already bound to the port.
    Trying rule: 5729 - Debug message.
    Trying rule: 5732 - Possible port forwarding failure.
    Trying rule: 5733 - User entered incorrect password.
    Trying rule: 5734 - sshd could not load one or more host keys.
    Trying rule: 5735 - Failed write due to one host disappearing.
    Trying rule: 5736 - Connection reset or aborted.
    Trying rule: 5707 - OpenSSH challenge-response exploit.
    Trying rule: 5701 - Possible attack on the ssh server (or version gathering).
    Trying rule: 5706 - SSH insecure connection attempt (scan).
       *Rule 5706 matched.

**Phase 3: Completed filtering (rules).
       Rule id: '5706'
       Level: '6'
       Description: 'SSH insecure connection attempt (scan).'
**Alert to be generated. 
//内容来自AnYun.ORG

2. 自定义日志泛化规则

2.1 添加日志源

添加日志源的方式很简单,通过修改/var/ossec/etc/ossec.conf 即可实现。 //本文来自安云网

如果日志源是本地文件,可通过添加如下配置实现。 //内容来自安云网

<localfile>
  <log_format>syslog</log_format>
  <location>/path/to/log/file</location>
</localfile> 

//内容来自AnYun.ORG

如果日志源是远程syslog,可通过添加如下配置实现。

//内容来自安云网

<remote>
<connection>syslog</connection>
<protocol>udp</protocol>
<port>2514</port>
<allowed-ips>172.16.24.0/24</allowed-ips>
</remote> //内容来自AnYun.ORG 

2.2 创建自定义的日志泛化规则

假如有两条日志如下文:

//本文来自安云网

Jun 11 22:06:30172.17.153.38/172.16.24.32 /usr/bin/auditServerd[25649]: User blackrat loginSUCEESS from 172.17.153.36 to 172.17.153.38 distport 3333 .
Jun 11 22:06:30172.17.153.38/172.16.24.32 /usr/bin/auditServerd[25649]: User blackrat login PWD_ERRORfrom 172.17.153.36 to 172.17.153.38 distport 3333 . //本文来自安云网 

该日志使用ossec-logtest分析之后结果如下:

//本文来自安云网

Jun 11 22:06:30 172.17.153.38/172.16.24.32 /usr/bin/auditServerd[25649]: User blackrat login SUCEESS from 172.17.153.36 to 172.17.153.38 distport 3333 .


**Phase 1: Completed pre-decoding.
       full event: 'Jun 11 22:06:30 172.16.25.130/172.16.24.32 /usr/bin/auditServerd[25649]: User blackrat login SUCEESS from 172.17.153.36 to 172.17.153.38 distport 3333 .'
       hostname: '172.17.153.38/172.16.24.32'
       program_name: '/usr/bin/auditServerd'
       log: 'User blackrat login SUCEESS from 172.17.153.36 to 172.17.153.38 distport 3333 .'

**Phase 2: Completed decoding.
       No decoder matched. //本文来自安云网 

由此可知OSSEC在分析日志的时候,经过了两个泛化过程:pre-decoding和 decoding。 //本文来自安云网

pre-decoding过程是ossec内置的,只要是标准的syslog日志,都可以解析出如下4个基本信息。

//内容来自AnYun.ORG

Timestamp:Jun 11 22:06:30 //本文来自安云网

Hostname: 172.17.153.38/172.16.24.32 //内容来自AnYun.ORG

Programe_name: /usr/bin/auditServerd

//内容来自AnYun.ORG

Log: User blackrat login SUCEESS from 172.17.153.36 to 172.17.153.38 distport 3333.

//本文来自安云网

在decoding过程,用户可以通过修改/var/ossec/etc/decoder.xml,实现自定义的泛化。例如在该文件中添加如下规则:

//内容来自安云网

<decoder name="auditServerd">
  <program_name>/usr/bin/auditServerd</program_name>
</decoder> 

//内容来自AnYun.ORG

再次执行/var/ossec/bin/ossec-logtest //本文来自安云网

**Phase 1: Completed pre-decoding.
       full event: 'Jun 11 22:06:30 172.17.153.38/172.16.24.32 /usr/bin/auditServerd[25649]: User blackrat login SUCEESS from 172.17.153.36 to 172.17.153.38 distport 3333 .'
       hostname: '172.17.153.38/172.16.24.32'
       program_name: '/usr/bin/auditServerd'
       log: 'User blackrat login SUCEESS from 172.17.153.36 to 172.17.153.38 distport 3333 .'

**Phase 2: Completed decoding.
       decoder: 'auditServerd' //内容来自安云网 

发现,该条日志成功命中了名为auditServerd的规则,该条规则可以准确的将日志定位为是程序auditServerd所发出的。 //本文来自安云网

除此之外,基于auditServerd这条规则,我们还可以添加更多的子规则,来识别出更多的信息。如: //内容来自安云网

<decoder name="auditServerd">                               
  <program_name>/usr/bin/auditServerd</program_name>                        
</decoder>                                                                                                                                                                                                                                       
<decoder name="auditServerd-login">                                      
  <parent>auditServerd</parent>                           
  <regex offset="after_parent">^User (\S+) login (\S+) from (\S+) to (\S+) distport (\S+) \.$</regex>  
  <order>user,status,srcip,dstip,dstport</order>                                
</decoder> //内容来自AnYun.ORG 

再次执行/var/ossec/bin/ossec-logtest,可获取更多的信息,如下: //内容来自AnYun.ORG

**Phase 1: Completed pre-decoding.
      full event: 'Jun 11 22:06:30 172.17.153.38/172.16.24.32/usr/bin/auditServerd[25649]: User blackrat login SUCEESS from 172.17.153.36 to172.17.153.38 distport 3333 .'
      hostname: '172.17.153.38/172.16.24.32'
      program_name: '/usr/bin/auditServerd'
      log: 'User blackrat login SUCEESS from 172.17.153.36 to 172.17.153.38distport 3333 .'
 
**Phase 2: Completed decoding.
      decoder: 'auditServerd'
       dstuser: 'blackrat'
      status:'SUCEESS'
      srcip: '172.17.153.36'
       dstip: '172.17.153. 
//内容来自AnYun.ORG

用户通过配置上述正则表达式,获取特定字段,用于后续的关联分析。OSSEC一共内置了14个用户可解析的字段: //本文来自安云网

   - location – where the log came from (only on FTS) //本文来自安云网

   - srcuser  - extracts the source username //本文来自安云网

   - dstuser  - extracts the destination (target) username

//内容来自AnYun.ORG

   - user     – an alias to dstuser (only one of the two can be used) //本文来自安云网

   - srcip    - source ip

//内容来自安云网

   - dstip    - dst ip

//内容来自安云网

   - srcport  - source port //内容来自安云网

   - dstport  - destination port //本文来自安云网

   - protocol – protocol

//内容来自AnYun.ORG

   - id       – event id 

//内容来自安云网

   - url      - url of the event

//本文来自安云网

   - action   – event action (deny, drop, accept, etc)

//本文来自安云网

   - status   – event status (success, failure, etc) //内容来自AnYun.ORG

   - extra_data     – Any extra data

//内容来自AnYun.ORG

3. 自定义日志告警规则

3.1 规则文件路径配置

 OSSEC的规则配置文件默认路径为/var/ossec/rules/,要加载规则文件,需要在/var/ossec/etc/ossec.conf 中配置,默认的配置如下: //本文来自安云网

 <ossec_config>  <!-- rules global entry -->
  <rules>
    <include>rules_config.xml</include>
    <include>pam_rules.xml</include>
    <include>sshd_rules.xml</include>
    <include>telnetd_rules.xml</include>
    <include>syslog_rules.xml</include>
    <include>arpwatch_rules.xml</include>                                                                                                                                                                                                     
     ......                                                                                                                                                                                     
    <include>clam_av_rules.xml</include>                                                                                                                                                                                                      
    <include>bro-ids_rules.xml</include>                                                                                                                                                                                                      
    <include>dropbear_rules.xml</include>                                                                                                                                                                                                     
    <include>local_rules.xml</include>                                                                                                                                                                                                        
</rules>                                                                                                                                                                                                                                      
</ossec_config>  <!-- rules global entry --> 
//内容来自AnYun.ORG

其实通过下列配置,可以实现加载/var/ossec/rules 下的所有规则文件: //内容来自AnYun.ORG

   <ossec_config>
    <rules>
        <rule_dir pattern=".xml$">rules</rule_dir>
    </rules>
</ossec_config> //内容来自安云网 

于泛化规则,也可以通过配置decoder_dir域来实现,如:

//本文来自安云网

<ossec_config>
    <rules>
        <decoder_dir pattern=".xml$">rules/plugins/decoders</decoder_dir>
    </rules>
</ossec_config> 

//内容来自AnYun.ORG

上述配置可将/var/ossec/rules/plugins/plugins/decoders目录下所有的xml文件都添加为OSSEC日志泛化规则。 //内容来自安云网

对于更详细的配置及语法,可参考下列文档: //内容来自AnYun.ORG

http://ossec-docs.readthedocs.org/en/latest/syntax/head_ossec_config.rules.html#element-rule_dir  //内容来自安云网


//内容来自安云网

3.2 OSSEC告警规则配置

例如,我们需要增加对程序auditServerd的告警规则,我们需要针对auditServerd程序新建一个规则文件,对于OSSEC中已经存在的规则文件如sshd, openbsd, vsftpd等,我们只需要在对应的文件中进行新增或修改。 //本文来自安云网

首先我们新建文件 //内容来自AnYun.ORG

/var/ossec/rules/auditServerd_rules.xml //内容来自安云网

添加如下内容:

//内容来自AnYun.ORG

<group name="auditServer,">
   <rule id="80000" level="0" noalert="1">
    <decoded_as>auditServerd</decoded_as>
    <description>Grouping for the auditServerd rules.</description>
  </rule>

  <rule id="80001" level="10">
    <if_sid>80000</if_sid>
    <user>blackrat</user>
    <srcip>172.17.153.36</srcip>
    <description>User blackrat is not allowed login from 172.17.153.36!</description>
  </rule>
</group> //内容来自安云网 

上述规则中,规则id 80000 用于对日志进行分组计数,假如日志中出现了泛化为auditServerd的日志,则对该日志分组为auditServer,且状态机计数加1.

//本文来自安云网

规则80001描述了假如user为blackrat,srcip为172.17.153.36 则命中,并发出“User blackrat is not allowed login from 172.17.153.36!”的告警。 //内容来自AnYun.ORG

将该文件路径加入到文件/var/ossec/etc/ossec.conf中

//内容来自安云网

  …
 <include>dropbear_rules.xml</include>                                                                                                                                                                                                     
<include>local_rules.xml</include> 
<include>auditServerd_rules.xml</include>                                                                                                                                                                                                       
</rules>                                                                                                                                                                                                                                      
</ossec_config> //内容来自安云网 

执行/var/ossec/bin/ossec-logtest,结果如下:

//内容来自安云网

**Phase 1: Completed pre-decoding.
       full event: 'Jun 11 22:06:30 172.17.153.38/172.16.24.32 /usr/bin/auditServerd[25649]: User blackrat login SUCEESS from 172.17.153.36 to 172.17.153.38 distport 3333 .'
       hostname: '172.17.153.38/172.16.24.32'
       program_name: '/usr/bin/auditServerd'
       log: 'User blackrat login SUCEESS from 172.17.153.36 to 172.17.153.38 distport 3333 .'

**Phase 2: Completed decoding.
       decoder: 'auditServerd'
       dstuser: 'blackrat'
       status: 'SUCEESS'
       srcip: '172.17.153.36'
       dstip: '172.17.153.38'
       dstport: '3333'

**Phase 3: Completed filtering (rules).
       Rule id: '80001'
       Level: '10'
       Description: 'User blackrat is not allowed login from 172.17.153.36!'
**Alert to be generated. //内容来自AnYun.ORG 

3.3 关联分析告警规则

OSSEC可以实现基于因果关系事件频次的关联分析告警,具体实现方式如下。 //内容来自AnYun.ORG

假如我们想要实现当来自同一IP的用户登陆auditServerd,在1分钟内达到5次登录失败时,进行告警,我们可以配置规则如下:

//内容来自AnYun.ORG

<group name="auditServer,">
   <rule id="80000" level="0" noalert="1">
    <decoded_as>auditServerd</decoded_as>
    <description>Grouping for the auditServerd rules.</description>
  </rule>

  <rule id="80001" level="10">
    <if_sid>80000</if_sid>
    <match>SUCEESS</match>
    <user>blackrat</user>
    <srcip>172.17.153.36</srcip>
    <description>User blackrat is not allowed login from 172.17.153.36!</description>
  </rule>

  <rule id="80002" level="1">
    <if_sid>80000</if_sid>
    <match>PWD_ERROR</match>
    <group>authServer_login_failures,</group>
    <description>login auditServerd password error.</description>
  </rule>

  <rule id="80003" level="15" frequency="5" timeframe="60" ignore="30"> 
    <if_matched_group>authServer_login_failures</if_matched_group>
    <description>auditServerd brute force trying to get access to </description>       
    <description>the audit system.</description>
    <same_source_ip />
    <group>authentication_failures,</group>
  </rule>
</group> 

//本文来自安云网

执行/var/ossec/bin/ossec-logtest,连续五次输入日志: //内容来自安云网

Jun 11 22:06:30 172.17.153.38/172.16.24.32 /usr/bin/auditServerd[25649]: User blackrat login PWD_ERROR from 172.17.153.36 to 172.17.153.38 distport 3333 . //本文来自安云网

结果如下: //本文来自安云网

**Phase 1: Completed pre-decoding.
       full event: 'Jun 11 22:06:30 172.17.153.38/172.16.24.32 /usr/bin/auditServerd[25649]: User blackrat login PWD_ERROR from 172.17.153.36 to 172.17.153.38 distport 3333 .'
       hostname: '172.17.153.38/172.16.24.32'
       program_name: '/usr/bin/auditServerd'
       log: 'User blackrat login PWD_ERROR from 172.17.153.36 to 172.17.153.38 distport 3333 .'
**Phase 2: Completed decoding.
       decoder: 'auditServerd'
       dstuser: 'blackrat'
       status: 'PWD_ERROR'
       srcip: '172.17.153.36'
       dstip: '172.17.153.38'
       dstport: '3333'

**Phase 3: Completed filtering (rules).
       Rule id: '80003'
       Level: '15'
       Description: 'auditServerd brute force trying to get access to the audit system.'
**Alert to be generated. 

//内容来自AnYun.ORG

对于OSSEC日志告警规则更详细的语法,参见:

//内容来自AnYun.ORG

http://ossec-docs.readthedocs.org/en/latest/syntax/head_rules.html 

//内容来自安云网

对于OSSEC中正则表达式的语法,参加:

//内容来自AnYun.ORG

http://ossec-docs.readthedocs.org/en/latest/syntax/regex.html  //内容来自安云网

//本文来自安云网

顶一下
(0)
0%
踩一下
(0)
0%
------分隔线----------------------------
发表评论
请自觉遵守互联网相关的政策法规,严禁发布色情、暴力、反动的言论。
评价:
验证码: 点击我更换图片
相关内容
推荐内容